I really really think you're mistaken. I completely agree that users choose passwords from a tiny subset of the possibilities and that counting the whole state

I really really think you're mistaken. I completely agree that users choose passwords from a tiny subset of the possibilities and that counting the whole state space is a nearly useless measure. But there just HAS to be more variability when users are forced to do something different. Like trying to find someone, or trying to find someone who has been disallowed from being at their home or work that day. The second person is going to be much harder to find, even if they're still really predictable and just end up at the coffee shop across the street. What lists of user passwords were you looking at? I looked through the default one used by John the Ripper (though they recommend using a larger one for any real purpose) and there were hardly any uses of punctuation at all (exceptions "iloveyou!" and "!@#$%^&*") so I can't make the least bit of conclusions. Reading the list of rules it uses to modify passwords, it prepends and appends digits and punctuation but doesn't seem to delete two characters and then replace them with 1!, or anything similar to that. (Though I'll admit to being inexpert at reading the rule formats and not understanding some). That's as close to empirical data as I've got this side of thinking about how I incorporate symbols and numbers.